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. Abstract 

' In a celebrated paper, Valiant and Vazirani [55] raised the question of whether the difficulty of 

NP-complete problems was due to the wide variation of the number of witnesses of their instances. 
They gave a strong negative answer by showing that distinguishing between instances having zero 
or one witnesses is as hard as recognizing NP, under randomized reductions, 
j. ' We consider the same question in the quantum setting and investigate the possibility of re- 

! ducing quantum witnesses in the context of the complexity class QMA, the quantum analogue 

of NP. The natural way to quantify the number of quantum witnesses is the dimension of the 
witness subspace W in some appropriate Hilbert space Ti.. We present an efficient deterministic 
^ • procedure that reduces any problem where the dimension d of is bounded by a polynomial 

^ ' , I to a problem with a unique quantum witness. The main idea of our reduction is to consider the 

^ ■ Alternating subspace of the tensor power Ti®'^. Indeed, the intersection of this subspace with 

^ I W®"^ is one-dimensional, and therefore can play the role of the unique quantum witness. 

1 Introduction 

. One of the most fundamental ideas of modern complexity theory is that, the study of decision making 

^ I procedures involving a single party should be extended to the study of more complex procedures 

' where several parties interact. The notions of verification and witness are at the heart of those 

complexity classes whose definition inherently involves interaction. The complexity classes P is the 
set of languages decidable by a polynomial-time deterministic algorithm. Similarly, BPP is the set 
' of promise problems decidable by a polynomial-time bounded-error randomized algorithm. We can 

■ think of such an algorithm as a verifier acting alone. The simplest interactive extensions of P and 

^ i BPP are their non-deterministic analogues, respectively NP and MA [101 [6]. These classes involve 

Ijpj I also an all powerful prover that sends a single message which is used by the verifier's decision making 

^ ' procedure together with the input. We require that on positive instances there is some message 

. , (called in that case a witness) that makes the verifier accept, whereas on negative instances the 

verifier rejects independently of the message sent by the prover. In the case of MA we can fix the 
permitted error of the verifier, rather arbitrarily to any constant, say 1/3. 

Quantum complexity classes are often defined by analogy to their classical counterparts. Since 
quantum computation is inherently probabilistic, the quantum analog of MA is considered to be the 
right definition of non-deterministic quantum polynomial-time. The quantum extension is twofold: 
the verifier has the power to decide promise problems in BQP, quantum polynomial-time, and the 
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messages he receives from the prover are also quantmn. Thus, QMA is the set of promise problems 
such that on positive instances there exists a quantum witness accepted with probability at least 2/3 
by the polynomial-time quantum verifier and on negative instances the verifier accepts every quantum 
state with probability at most 1/3. While the idea that a quantum state might play the role of a 
witness goes back to Knill [18], the class was formally defined by Kitaev [T7] under the name of BQNP. 
The currently used name QMA was given to the class by Watrous [29]. Kitaev has established several 
error probability reduction properties of QMA, and proved that the Local Hamiltonian, the quantum 
analog of SAT was complete for it. Watrous has shown that Group non-Membership was a problem in 
QMA and based on this result he has constructed an oracle under which MA is strictly included in 
QMA. Since then, various problems have been proven to be complete for QMA [141 1161 [2T| 115 ^ I22j. A 
potentially weaker quantum extension of MA, namely QCMA, was defined by Aharonov and Naveh [1]: 
in the case of QCMA, the verifier is still a quantum polynomial-time algorithm, but the message of 
the prover can only be classical. 

The number of witnesses for positive instances of problems in NP can be exponentially high. Also, 
known NP-complete problems have different instances with widely varying numbers of solutions. In 
a celebrated paper. Valiant and Vazirani [28j have raised the question of whether the difficulty of the 
class NP was due to this wide variation. They gave a strong negative answer to this question in the 
following sense. Let UP be the set of problems in NP where in addition on positive instances there 
exists a unique witness. We denote by PromiseUP the extention of UP from languages to promise 
problems. The theorem of Valiant and Vazirani states that any problem in NP can be reduced 
in randomized polynomial-time to a promise problem in PromiseUP, or in set theoretical terms, 
NP C RpPromiseUP^ where RP is the subclass of problems in BPP where the computation does not err 
on negative instances. The complexity class UP has also its importance because of its connection to 
one-way functions: worst case one-way functions exist if and only if UP 7^ P |19l lllj . 

In a recent paper Aharonov, Ben-Or, Brandao and Sattah [3j have asked a similar question for 
MA, QCMA and QMA. The restriction of the classical-witness classes MA and QCMA to their unique 
variants UMA and UQCMA is rather natural: no change for negative instances, but on positive 
instances there has to be exactly one witness that makes the verifier accept with probability at least 
2/3, while all other messages make him accept with probability at most 1/3. The definition of UQMA, 
the unique variant of QMA is the following: there is no change for negative instances with respect 
to QMA, but on positive instances there has to be a quantum witness state \ip) which is accepted 
by the verifier with probability at least 2/3, whereas all states orthogonal to \ip) are accepted with 
probability at most 1/3. Aharonov et al. extended the Valiant- Vazirani proof for the classical witness 
classes by showing that MA C RpUMA QCMA C rrUQCMA ^j^^ ^^y^qt hand, they left the 
existence of a similar result for QMA as an open problem. 

Why is it so difficult to reduce the witnesses to a single witness in the quantum case? The basic 
idea of Valiant and Vazirani is to use pairwise independent universal hash functions, having poly- 
nomial size descriptions, that eliminate independently each witness with some constant probability. 
The size of the original witness set can be guessed approximately by a polynomial-time probabilistic 
procedure, and in case of a correct guess the hashing keeps alive exactly one witness with again some 
constant probability. The same idea basically works for MA and QCMA as long as one additional 
difficulty is overcome: on positive instances there can be exponentially more "pseudo- witnesses" , 
accepted with probability between 1/3 and 2/3, than witnesses which are accepted with probability 
at least 2/3. In this case, the Valiant- Vazirani proof technique will eliminate with high probability 
all witnesses before the elimination of the pseudo-witnesses. The solution of Aharonov et al. for this 
problem is to divide the interval (1/3,2/3) into polynomially many smaller intervals and to show 
that there exists at least one interval such that there are approximately as many witnesses accepted 
with probability within this interval as above it. 
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In the quantum case, the set of quantum witnesses can be infinite. For a promise problem in 
QMA, we can suppose without loss of generality that on positive instances there exists a subspace 
W such that all unit vectors in W are accepted. The dimension of W could be large and we wish 
to reduce it to one. Aharonov et. al [3] considered the special case where the dimension of W is 
two. Although classically two witnesses are trivially reducible to the unique witness case, they have 
shown that the natural generalization of the Valiant -Vazirani construction cannot solve even the 
two-dimensional quantum witness case. 

Indeed, the natural generalization of the Valiant- Vazirani construction to this situation is to 
use random projections and hope that some one-dimensional subspace of W will be accepted with 
substantially higher probability than its orthogonal. A first difficulty is to implement such projections 
efficiently. But more importantly, a random projection would not create a polynomial gap in the 
acceptance probabilities for the pure states of VF: in fact all states in W which were accepted with 
exponentially close probabilities, will still be accepted after the random projection with exponentially 
close probabilities. 

Here we describe a fundamentally different proof technique to tackle this problem, which is suf- 
ficiently powerful to solve the case when the dimension of the witness subspace W is polynomially 
bounded in the length of the input. This leads us naturally to the quantum analog of the promise 
problem class FewP. This complexity class was defined by Allender [3] as the set of problems in NP 
with the additional constraint that there is a polynomial q such that on every positive instance of 
length n, the number of witnesses is at most q{n). The class FewP was extensively studied in the 
context of counting complexity classes (SJ ETJ [20l [121 [26] . We define FewQMA, the quantum analog 
of FewP, as the set of promise problems in QMA for which there exists a polynomial q with the fol- 
lowing properties: on negative instances every message of the prover is accepted by the verifier with 
probability at most 1/3; on a positive instance x there exists a subspace Wx of dimension between 
1 and ^/da^l), such that all pure states in Wx are accepted with probability at least 2/3, while all 
pure states orthogonal to Wx are accepted with probability at most 1/3. Our main theorem extends 
the result of Valiant and Vazirani to this complexity class. More precisely, we show that FewQMA is 
deterministic polynomial-time Turing-reducible to UQMA. 

Main Theorem FewQMA C pUQMA 

The first idea to establish this result is that instead of manipulating the states within the original 
space TC of dimension K, we consider its t-fold tensor powers TC^^. At first glance, this does not seem 
to be going in the right direction because the dimension of W'^^ grows as d*, where d is the dimension 
of the witness space W. Our second idea is to consider the alternating subspace Alt of 7^®* whose 
dimension is (^). The important thing to notice is that the dimension of the intersection Altn VF®* 
is equal to one when t = d. The reason is that this intersection is in fact equal to the alternating 
subspace of W'^^ whose dimension is (^). Therefore, we will choose this one-dimensional subspace 
as our unique quantum witness. Of course, we don't know exactly the dimension of W, but since we 
have a polynomial upper bound on it, we just try every possible value t between 1 and 

For a fixed t, we would ideally implement H^y^t -IlAit, the product of the projection to Alt followed 
by the projection to VF®*. The reason that this would work is the following. The unique pure state in 
Alt n W'^* (up to a global phase) is clearly accepted with probability 1. On the other hand, we claim 
that any state |0) orthogonal to that is rejected with probability 1. Indeed, can be decomposed as 
\4>i) + \4'2), where \4>i) G Alt"*" and \4>2) £ VF®*"*". Therefore lipi) is rejected by Ham and |02) is rejected 
by n^®t. This implies the claim since we can show that the two projectors actually commute. 

We can efficiently implement Umi by a procedure we call the Alternating Test. A similar procedure 
to ours, implementing efficiently the projection to the symmetric subspace Sym of W®*, was proposed 
by Barenco et al. [7J as the basis of a method for the stabilization of quantum computations. In fact. 
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in the two-fold tensor product case, the two procedures coincide and become the weh know Swap Test 
which was used by Buhrman et al. [9] for deciding if two given pure states are close or far apart. 

We can't implement Xlyj/^t exactly, but we can approximate it efficiently by a procedure called the 
Witness Test. This test just applies independently to all the t components of the state the procedure 
at our disposal which decides in TC whether a state is a witness or not, and accepts if all applications 
accept. There is only one difficulty left: since IlAit and the Witness Test don't necessarily commute, 
our previous argument which showed that states in 1^®* were rejected with probability 1 doesn't 
work anymore. We overcome this difficulty by showing that the commutativity of the two projections 
implies that the projections to Alt of such states are also in VF®* , and therefore get rejected with 
high probability by the Witness Test. 

An interesting feature of our reduction is that it is deterministic, while the Valiant- Vazirani 
procedure is probabilistic. It is fair to say though that classically the witnesses can all be enumerated 
when their number is bounded by a polynomial. Therefore, in that case, the reduction can also 
be done deterministically, implying that FewP C pPromiseUP^ believe that reducing QMA to a 
unique witness, which this paper leaves as an open question, will require a probabilistic or a quantum 
procedure. 

The rest of the paper is structured as follows. In Section [2] we state some facts about the 
interaction of the tensor products of subspaces with the alternating subspace. In Section [3] we define 
the complexity classes we are concerned with. We give two definitions for FewQMA and show that 
they are equivalent. Section d] is entirely devoted to the proof of our main result. Finally in the 
Appendix [A] we consider a third definition and show a weak equivalence with the previous ones. 

2 Preliminaries 

In this section we present definitions and lemmas that we will need in the proof of our main result. 

We represent by [t] the set {1,2,..., t}. For a Hilbert space TC, we denote by dim('H) the dimension 
of TL. For a subspace S of H, let S-^ represent the subspace of Tl orthogonal to S, and let II^ denote 
the projector onto S. For subspaces 81,82 oiTL, their direct sum 81 + 82 is defined as span(5i U ^2), 
and when ^i, 5*2 are orthogonal subspaces, we denote their (orthogonal) direct sum by 81® 82- The 
following relations are standard. 

Fact 1 1. Let 81, 82 be subspaces of a Hilbert space 7i. Then {Si n 82)'^ = Si + 82 ■ 
2. Let 81,82 be subspaces of Hilbert spaces 7ii, 7i2 respectively. Then, {81 (gi 82)'^ = 

i8^(^n2) + {ni0 8^) = (5f 0^2)0 (Si 52^). 

Let B represent the two-dimensional complex Hilbert space and let {|0), |1)} be the computational 
basis for B. For a natural number k, the computational basis of B^^ (the fe-fold tensor of B) consists 
of {|r) : r S {0, 1}'^}, where |r) denotes the tensor product |ri) ® . . . ® jr^) for the A;-bit string 
r = ri . . . rfc. Fix k and let Ti denote B^^ and let K = 2^. By a pure state in Tl, we mean a unit 
vector in TC. A mixed state or just state is a positive semi-definite operator in TC with trace 1. We 
refer the reader to the text [24] for concepts related to quantum information theory. For a natural 
number t € [K], we will think of states of as consisting of t registers, where the content of each 
register is a state with support in TC. 

We will consider the interaction of ly®*, where TV is a d-dimensional subspace of TC for some d 
satisfying 2 < t < d < K , with the alternating and symmetric subspaces of "H®*. Let 8t denote the 
set of all permutations vr : [t] ^ [t]. For a permutation vr G 8t, let the unitary operator Ut^, acting on 
W®*, be given by ... |s^(t)) . 

For permutations '7ri,7r2, let tti o 712 represent their composition. It is easily seen that C/7rio7r2 = 
UniU.jt2- -^o^ distinct i,j £ [t], let vTjj be the transposition of i and j. For all distinct i,j G [t], the 
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symmetric subspace of W'^^ with respect to i and j is given by 

SymJ^'^* = {\(f)) G VF®* : UT^i.\4>) = \4>)}, and the symmetric subspace of VF®* is defined as Sym^^* 



rii^jSymJJ'^ . Similarly, for all distinct i,j G [t], the alternating subspace of W'^^ with respect to 



and j is defined as AltJJ = {|(?i>) G M/^®* : [7^^^. |</)) = — |<?i)}, and the alternating subspace of ly*^* is 
defined as Alt^®' = Di^jMt^'^'. 

The subspaces Sym^^ and Alt^^ are of dimension C^^^^^) and (j) respectively |8j. In particular, 
Alt^'^ and Sym^^ have respective dimensions {^2^) and (■^) and since they are orthogonal, we have 
-^02 ^ Alt''^®' © Sym"^®'. This implies that for every distinct i,j E [t], we have AltJ^®* © Sym]J®' = 
T^®*. It follows that 

Claim 1 (Alt^^y n W^' = E.^, Sym,^^* . 



Proof Since Alt]J" © Sym]J" = VF®*, we have (Alt]J" )^ = Sym]J" © (VF®*)^. Therefore 

(Alt^'^y n VF®* = ((ni^,Alt,^''y)nTy^* (from definition of Alt^""') 
= (^(Alt.^^y ) n VF®* (from Fact [U 

= (^^(Sym,^®*© (H^«y))nPF«* 

= ((j;SymJJ^')©(PF«y)nVF®* = Sym, 



The last equahty holds since {J2i^j SymJ^®*) C VF®*. □ 

Note that for VF = W the claim states that (Alt^®')-^ = Ej^jSym^®*. For us, a particularly 
important case is when the number of registers t is equal to d, the dimension of the subspace W. 
Then the alternating subspace Alt^^ is one-dimensional. Let {iV'i)) • • • > IV'd)} be any orthonormal 
basis of W, and let the vector \Wait) S W'^'^ be defined as \Wait) = YlneSa ^S'^(^) ^^ttI^i) • • • li^d), 
where sgn(7r) denotes the sign of the permutation tt. The following claim states that |VFaZt) spans the 
one-dimensional subspace Alt'^^ . This immediately implies that |VFa/i) is independent of the choice 
of the basis (up to a global phase) . 

Claim 2 Alt^^' = span{|Ty,,,)} . 



Proof We show that |VFait) £ Alt . This implies the statement since dim(Alt^"'') = (^) = 1. For 



any distinct i,j G [d] we show |VFa/i) G AltJ^* . For a permutation vr G Sd, we set vr' = vTjj o vr. We 



then have 

= C/7r,,-i^ X] ^Sn(vr) [/^|V'i)©...©|^d) = ^ sgn(7r) C/^^.o^|V'i)©---©|^d) 

= -= ^ sgn(7r^r.i ^ ^/^ U^,\^i) © ... © \ipd) = (-1) • ^ sgn(7r') ^J^'IV'i) © ... © \^pd) 

where we used that sgn(7rj^.-'^ o tt') = — sgn(7r'). □ 

Next, we show that the projections on the spaces Alt^*^ and W®^ commute for any 2 < t < d. 
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Claim 3 Let 2 < t < d. Then, n^|^^igit • Il^y®* = Il^igit • H^^^-^^t . 

Proof Set T = (Alt^®V n W^K Then VF®* = Alt'^®' © T and hence, U^m = n^^iy®* + ^T- We 
have 

= ^SymJJ^* (from Claim [1]) 
C ^ SymJ^'^* (by definition) 

= (Alt^^'V (from Claim [H) . 

This implies that U^^^n^t -Ut = UT-U^^^n^t = 0. Also, Alt^®* C Alt^®' since Alt^®* = Alt^®*nTy®*. 
Therefore, we have 



Similarly 



Hence H^^^-nm ■ n^®t — XIj^/®* • H^^^-nm . □ 

This commutativity relation enables us to derive the following property 
Claim 4 For any state |(/>) G (Alt^®'')-^, we have n^|^^»d|0) G (Ty'^'^)-^. 

Proof First note that (Alt'^®')^ = (Alt^®' n W^'^)^ and by Fact 1, (Alt^®')^ = (Alt^®')^ + 
(H^®'i)-L. Hence we can decompose as {(pi) + \(p2), where G (Alt'^®'')-^ and |(/)2) G (VF®'^)-^. As 
n^i^^®d = 0, it suffices to show that n^|^^®d |(/)2) G (1^®°')-'-. For this, we prove that H^^y^d-jx • 



Claim [3] implies that 



Also, 14)2) = n(^®d)x |(/)2) since |(/)2) G (W^®'^)-'". Therefore we can conclude by the following equalities: 

n(iy®d)x • H^i^^®d|(/)2) = n^nH®d ■ n(v^/<g.d)x|(/>2) 

□ 



3 Complexity classes 

In this section we define the relevant complexity classes and state the facts needed about them. For 
a quantum circuit V, we let V also represent the unitary transformation corresponding to the circuit. 
We call a verification procedure a family of quantum circuits {Vx : x G {0, 1}*} uniformly generated 
in polynomial-time, together with polynomials k and m such that Vx acts on A;(|a;|) + ?ti(|x|) qubits. 
We refer to the first A;(|x|) qubits as witness qubits and to the last m(|x|) qubits as auxiliary qubits. 
To simplify notation, when the input x is implicit in the discussion, we refer to A;(|x|) by k, and to 
m(|j;|) by m. We will make repeated use of the following projections in 

liacc = \l){l\0lk+m-l, ^init = 4 ® |0'")(0'^|, 
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where /„ is the identity operator on n qubits. We will also make use of the operator defined as 
n^; = HinitVx^accVx^init- It is casy to See that H^- is positive semi-definite. 

Given a verification procedure, on input x, a Quantum Merlin-Arthur protocol proceeds in the 
following way: the prover Merlin sends a pure state G ^^'^^ the witness, to the verifier Arthur, 
who then applies the circuit Vx to \ip) and accepts if the measurement of the first qubit 

of the result gives 1. We will denote the probability that Arthur accepts x with witness by 
Pr[Vx outputs Accept on IV')], which is equal to | jllaccVlcdV') ® lO™-))!]^. 

A promise problem is a tuple L = (Ly^s, L^o) with Ly^g U L„o C {0, 1}* and Lygg H L^o = 0- We 
now define the following complexity classes. 

Definition 1 A promise problem L = {Lygs,Lno) is in the complexity class Quantum Merlin- Arthur 
QMA if there exists a verification procedure {Vx : x E {0, 1}*} with polynomials k and m such that 

1. for all X G Lyes? there exists a witness \'4)), such that \\^a(xVx{\'4') ® |0™))|p > 2/3, 

2. for all X G L^o, and for all witnesses \\Iiaccyx{\i') ® |0™))|P < 1/3. 

For a promise problem in QMA, we can suppose without loss of generality that on positive 
instances there exists a subspace W such that all unit vectors in W are accepted. Hence, by putting 
a polynomial upper bound on the dimension of this subspace, we derive the following definition: 

Definition 2 Let c,w,s : N [0, 1] be polynomial-time computable functions such that c{n) > 
max{u)(n), s(n)} for all n & N. A promise problem L = (Lyes,Lno) is in the complexity class Few 
Quantum Merlin- Arthur FewQMA(c, i/;, s) if there exists a verification procedure {Vx : x G {0,1}*} 
with polynomials k and m, and a polynomial q such that 

1. for all X G Lyes there exists a subspace Wx of B®^ with dim(Wa;) G such that 

(a) for all witnesses \'4)) G Wx, \\^accVx{\ip) ® lO'"))!^ > c(|x|), and 

(b) for all witnesses |(/)) G Wx^ , \\liaccVx{\(t>) ® |0™))||2 < w{\x\), 

2. for all X G L^o and for all pure states \'ip) G B®^ , \\IiaccVxi\tp) ® |0™))|p < s{\x\). 

Definition 3 The class Few Quantum Merlin- Arthur FewQMA is FewQMA(2/3, 1/3, 1/3). 

We next provide an alternative definition of FewQMA(c, it;, s) and show that the two definitions 
are equivalent. 

Definition 4 Let c,w,s : N [0, 1] be polynomial-time computable functions such that c(n) > 
max{w(n), s(n)} for all n G N. A promise problem L = {Lyes,Lno) is in the complexity class 
Alternative-FewQMA(c, w, s) if there exists a verification procedure {Vx : x G {0, 1}*} with polynomials 
k and m, and a polynomial q such that 

1. for all X G Ly(,s, the number of eigenvalues oflix which are at least c(|x|) is in [qi\x\)\, and no 
eigenvalue ofHx is in the open interval {w{\x\),c{\x\)). 

2. for all X G Lno, all eigenvalues ofHx are at most s{\x\). 

We prove the following equivalence between the two definitions. 

Theorem 1 Let c, iw, s : N ^ [0, 1] be polynomial-time computable functions such that c{n) > 
max{'u;(n), s(n)} for all G N. Then FewQMA(c, w, s) = Alternative-FewQMA(c, w, s). 
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Proof Part 1 (Definition |4]=^> Definition [2]): Let L be a promise problem Alternative-FewQMA(c, w, s) 

with some verification procedure {Vx} and polynomial q according to Definition HI We show that 
{Vx} and q satisfy also Definition [2] with the same parameters. 

We first consider the case x € L. For every |n) G ^® ^ have 

||naccK'nj„it|u)||^ = {u\Ilx\u) . (!) 

It is easy to check that all eigenvectors of Tlx are also eigenvectors of Umit- The 1-eigenvectors of 
the projector Hinit are of the form \u) (E> \0"^) with \u) G B^^, and any vector orthogonal to these is 
an eigenvector with eigenvalue 0. Let r be the number of eigenvalues of that are at least c(|a;|), 
by hypothesis r G [Qd^^l)]- Let {\vi) (X" lO™") : i G [r]} be a set of orthonormal eigenvectors of Tlx with 
respective eigenvalues {Aj > c{\x\) : i G [r]}, we set Wx = span({|fj) : i G [r]}). Then all remaining 
2k+m _ ^ eigenvalues of n^; are less than or equal to t^da^l). Let {\vi) |0"*) : i G {r + 1, . . . , 2'^"'"™'}} 
be a set of orthonormal eigenvectors with such eigenvalues. It is clear then that = span({|fj) : 
r<i< 2^=+™}). 

We consider a pure state l-^) = J^ieH o^il^i) ™ Then, 

\\naccVxm(S)\On)f = maccVxUinitm(S)\On)f 

= ((v|®(o-|)(n,|V)®|o™)) 

= ((Vl^3(0"|)((^A,a,-|^;,))®|0™)) 

ie[r] 

= J];|aip-Ai > c{\x\) . 

ie[r] 

If G is a pure state then by similar arguments we get UlIaccKcd';^) ^ lO™"))!!^ ^ ''^(kl)- 

When X ^ L, condition 2 of Definition [2] gets satisfied analogously from condition 2 of Definition HI 

Part 2 (Definition [2] =^ Definition [4]): Let L G FewQMA(c, s) with some verification procedure 
{Vx} and polynomial q according to Definition [2l We claim that {Vx} and q satisfy also Definition |4] 
with the same parameters. 

First consider the case x G L. The cardinality of the dimension of the subspace of witnesses Wx 
in B^'^ is in by hypothesis. We set 

Wc = span{|w) G B^'' : \v) (8) jO™') is an eigenvector of 11^ with eigenvalue > c(|j;|)} , 

and 

Ww = span{|^;) G B'^'^ : \v) jO™') is an eigenvector of with eigenvalue > . 

We will show that dim(Wa;) = dim(Wc) and that Wc = W^, from which the claim follows. For this, 
it is sufficient to prove that dim(Wc) = dim(Wa;) = dim(TV^), since clearly Wc is a subspace of Ww 
First observe that the definitions of Wc and W^ imply that 

Wc = span{|t;) G B®^ : |u) |0™) is an eigenvector of 11^: with eigenvalue < c(|x|)} , 

and 

W^ = span{|u) G B®^ :\v) ® |0"^) is an eigenvector of 11^; with eigenvalue < twdxl)} . 

Let us suppose that dim(Wa;) < dim(Wc)- Then there exists a vector \u) in Wc H Wx- Since 
|m) G Wci using arguments as in Part 1 above, we have UlIaccKcd^i) ® lO'"))!^ > c(|x|). However, 
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since \u) G W^, from condition 1(b) of Definition [2] we have ||naccVir(|u) lO"^))!]^ < < c{\x\) 

which is a contradiction. We similarly reach a contradiction assuming dim(Wx) > dim(l^c) and hence 
dim(W^) = dim(VFc). 

The equality dim(W^) = dim(Wa;) can be proven by an argument analogous to the proof of 
dim{W^) = dim(Wc). 

In the case x ^ L, assume for contradiction that there is an eigenvalue A > of Hx with 

eigenvector \v) \0^). Then as before, 

= ((t;|®(0^'"|)n,(|t;)®|0'")) = A > s{\x\) , 

which contradicts condition 2 of Definition [2j □ 

The alternative definition of FewQMA(c, ti;, s) is useful in arriving at the following strong er- 
ror probability reduction theorem whose proof follows very similar lines as the QMA strong error 
probability reduction proof in Marriott and Watrous '23] and hence is skipped. 

Theorem 2 (Error reduction) Let c,w,s : N — > [0, 1] be polynomial-time computable functions 
such that for some polynomial p, for all n, they satisfy c{n) > max{^i;(r^), s(n)} + l/p{n). Let r he 
any polynomial. Then for any L G FewQMA(c, s) having a verification procedure with polynomials 
k, m, q, there exists a verification procedure for L with parameters (c', w' , s') = (1 — 2~^, 2"'", 2~^) and 
polynomials k' = k, m' = poly{m,r) and q' = q. 

Definition 5 A promise problem L = {Lyes, Lno) is in the complexity class Unique Quantum Merlin- 
Arthur UQMA if L is in FewQMA with the additional constraint that for all x G Ly^g, the subspace 
Wx of witnesses in the definition of FewQMA is one- dimensional. 

Definition 6 UQMA-CPP is the promise problem (UQMA-CPPj^e^, UQMA-CPP„o) where the ele- 
ments o/ UQMA-CPPj,es U UQMA-CPPno are descriptions of quantum circuits V with k witness qubits 
and m auxiliary qubits, such that 

L V e UQMA-CPPj^e, if 

(a) there exists a witness such that Pr\y outputs Accept on |^)] > 2/3, 

(b) for all witnesses \4>) orthogonal to 1-0), Pr[y outputs Accept on |0)] < 1/3, 

2. V & UQMA-CPP„o if for all pure states IV'), Pr\V outputs Accept on IV')] < 1/3. 
It is easily verified that UQMA-CPP is the canonical UQMA-complete promise problem. 

4 Reducing the dimension of the witness subspace 

This section will be entirely devoted to the proof of our main result. 

Theorem 3 (Main Theorem) FewQMA C pUQMA 

Proof 

Let L G FewQMA have a verification procedure {V!^ : x G {0, 1}*} with polynomials k,m',q. Let 
r be a polynomial such that q2~^ < 1/3. Then, we know from Theorem [2] that L G FewQMA(l — 
2~^, 2~'", 2"'') with verification procedure {Vx : x G {0, 1}* and polynomials k,m,q. 
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Our goal is to describe a deterministic polynomial-time algorithm A, with access to the oracle 
O for the promise problem UQMA-CPP, that decides the promise problem L. In high level, our 
algorithm works in the following way. On input x and for all t G [^d^cl)]; A calls O with a quantum 
circuit A^. that uses t ■ k witness qubits and t ■ m auxiliary qubits, and outputs Accept if and only 
if the witness has the following two properties: first, it belongs to the alternating subspace of H®* 
and second the circuit Vx, when performed on each of the t registers separately, outputs Accept on 
all of them. A accepts iff for any t, oracle O accepts. We will prove that for x G Ly^g, we have 
A'^ G UQMA-CPPj^es, where d = dim.{Wx)- Hence O accepts ^* and therefore A accepts. On the 
other hand, for x <E Lno, we show that for all t G G UQMA-CPP„o and hence A rejects. 

We first describe in detail the Alternating Test and the Witness Test that appear in the algorithm. 
In our descriptions below k,m,q,r represent the integers m(|x|), and r{\x\) respectively. 

4.1 Alternating Test 

Let H be the Hilbert space B'^'^ and let t G [2^^]. Let us fix some polynomial-time computable 
bijection between the set [t\] and the set of permutations St- Let Vt be the (t!)— dimensional Hilbert 
space spanned by vectors for i G [t\]. We will use the elements of St for describing the above basis 
vectors via the fixed bijection. 

The Alternating Test with parameter t receives, as input, a pure state in H®* and performs a 
unitary operation in the Hilbert space Vt <^ K®*, followed by a measurement. We will refer to the 
elements of Vt W®* as consisting of two registers R and 5, where the content of each register is a 
mixed state with support over the corresponding Hilbert space. 

Let us define jperm^) = -j= T^neSt sgn(7r)|7r). 



Alternating Test(i) 

Input: A pure state |^) G in the (t • /c)-qubit register S 
Output: The content of register S and Accept or Reject. 

1. Create the state YlneSt 1^)) 1'^)- 

2. Apply the unitary U : \Tr) ^ lip) |7r) (g) Ut,\iJj). 

3. Perform the measurement (M,I — M), where M = |permj)(permj| 
/•^®t. Output the content of S. Output Accept if the state has been 
projected onto M and output Reject otherwise. 

It is easily verified that the Alternating Test(i) runs in time polynomial int- k. Since we will only 
call it with t G [q], its running time will be polynomial in \x\. The following lemma states that the 
Alternating Test(t) is a projection onto the subspace Alt"^^*. 

Lemma 1 1. For any pure state G Alt'^* , the Alternating Test(i) outputs the state \^) and 
Accept with probability 1. 

2. For any G (Alt'^*')-'-, the Alternating Test(t) outputs Accept with probability 0. 

Proof Part 1: Since l'^) G Alt^^* we have L'jrlV') = sgn(7r) • l'^), and therefore the state after 
Step 2 is 

^ ^ Itt) (g) C/^IV') = ^ XI ^Sn(vr) • |7r) ® = Iperm^) ® jV'). 
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Part 2: By Claim [H we have (Alt'^ = Y^i^j Sym^) . Hence it is enough to show that for 

all distinct i,j G [t] and for any vector \(f)) G Sym^'^*, the probability p that the Alternating Test(t) 
outputs Accept is 0. We have 

1 1 

= E sgn(^)-sgn(vr).(,^|[/tC/.|0) 

We define tt' = vr o vTjj. Then vr = vr' o vr^r.^ = vr' o vTjj and sgn(7r) = — sgn(7r'). Since \(f>) S SymJ^*^ , we 
have C/tt.J^) = |0) and hence UT,/on,j\<P) = f^Tr' • iUn,j\<P)) = f^Tr'l'/')- Therefore, 

= (^)' E sgn(a).sgn(7r).(0|C/tC/,|</,) = (-1) • (^)' E sgn(a) • sgn(7r') • 

= (-l)-(^)' E sgn(a)-sgn(7r')-(0|C/tc/^,|</)) = -p 
Hence p = 0. □ 
4.2 Witness Test 

The Witness Test with parameter t £ [q] receives as input a pure state in "H®* and performs a unitary 
operation in the Hilbert space H'^^ ^B®^^"^^ followed by a measurement. We will refer to the elements 
of n®* ® ^®(tm) consisting of t pairs of registers (Tj, Zi) respectively on k and m qubits, for i G [t\. 
All registers Zi will be initialized to lO'"). 



Witness Test(t) 




Input: A pure state -0) ^ "^^^ in the A;-qubit registers Tj, 


for i G [t] 


Output: Accept or Reject 




1. For all i G [t], append a register Zi initialized to 


and apply the 


circuit Vx on registers {Ti,Zi). 




2. Output Accept if for all i G ^ outputs Accept; 


otherwise output 


Reject. 





We can describe the Witness Test(t) as the operator (Hqcc^)®* acting on a state IV') O 10**^). Hence, 
Pr[WitnessTest(t) outputs Accept on IV')] = \\(n.accVx)'^WTp) ® |0*""))|p. Note that the description 
of the circuit V^* can be generated in polynomial-time, since the circuit family {Vx,x G {0, 1}*} is 
uniformly generated in polynomial-time. 

In what follows we will have to argue about the probability that the verification procedure Vx 
outputs Accept when its input is some mixed state. Even though we have only considered pure 
states as inputs in the definition of the class FewQMA, we will see that it is not hard to extend our 
arguments to mixed states. 

Lemma 2 i. // x G Ly^s, then for every lip) G W!®*, the Witness Test(f) outputs Accept with 
probability at least 2/3. 
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2. If X G Lyes, then for every \(f)) G (W^*)-*-, the Witness Test(t) outputs Accept with probability at 
most 1/3. 

3. If X £ Lnoj then for every G W®*, the Witness Test(t) outputs Accept with probability at 
most 1/3. 

Proof Part 1: By completeness we know that for any pure state £ we have 
Pr[Va; outputs Reject on |^')] < 2"*". Let pi denote the reduced density matrix of on register Tj. 
Since IV') G Wx®^ , then for every i G [t], the density matrix pi is a distribution of pure states that all 
belong to Wx and hence P'c\Vx outputs Reject on pi] < 2~^. It follows from the union bound that 

t 

Pr[WitnessTest(t) outputs Accept on IV')] > 1 - ^ Pr[K outputs Reject on pi] > 1 - t • 2"'' > 2/3, 

i=l 

where the last inequality follows from the choice of r. 

Part 2: For i £ [t], let Si = Wx<^ ■■ .<^Wx (Si Wx ®7i . . .®7i, where Wx stands in the z"' component 
of the tensor product. By Fact [U we have (W^®*)-^ = ©jg[j] Si. 

Let us therefore consider a pure state \4>) G ®iiz[t\Si and let |(/)) = Ylii<^[t\^i\'t'i) ■> where |(/>i) 
is a pure state in Si. Then X]i=i I'^iP = ^ because the |(/'i)'s are also orthogonal. Furthermore, 
let Pi be the reduced density matrix of on register Tj. Then the support of pi is over VF^f . 
Since for any pure state G VKj^*" we have Pr[T4 outputs Accept on 10')] < , we conclude that 
Pr\Vx outputs Accept on pi] < 2~^. 

The probability that the Witness Test(t) outputs Accept on {(pi) is equal to the probability that 

th 

all t applications of Vx output Accept, which is less than the probability that the i application of 
Vx outputs Accept, since the projections, performed in different registers, commute. Hence, 

Pr[WitnessTest(t) outputs Accept on \(j)i)] < Pr[Vx outputs Accept on pi] < 2~^. 

Now for the input \(f)) we have 

Pr[WitnessTest(t) outputs Accept on |(^)] = \\{UaccVx)®W(f>) |0*'"))|p 

= \\^ai{UaccVxr'm^\o'n)\\' < {^\a,\-maccVxf'm^\o'n)\\f 

^ (El"'l')-Ell(n--^-)®*(l'^*)®|o*'"))ll') ^ ^ 1/3. 

ie[t] je[t] 

In the above calculation the first two inequalities follow respectively from the triangle inequality and 
the Cauchy-Schwarz inequality. 

Part 3: By the soundness of the original protocol we know that for any pure state |^') G 
TC Pr[V^ outputs Accept on < 2~'^ . The same holds for any mixed state as well. Since the 
probability that the Witness Test(t) outputs Accept is at most the probability that the procedure Vx 
accepts the state on the first register Ti we conclude that 

Pr[WitnessTest(t) outputs Accept on \ip)] < Pr[Vx outputs Accept on pi] < 2~'' < 1/3. □ 
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4.3 Putting it all together 

Finally we describe the algorithm A in the figure below and proceed to analyze its properties. 

Algorithm A 

Input: X G Lyes U L„o 
Output: Accept or Reject 

1. For t = 1, . . .,qi\x\) do: 

(a) Call the oracle O with input A* , where A^. is the description of the circuit 
of the following procedure on t-k witness qubits and t ■ m auxiliary qubits 

Input: A pure state IV') G ; Output: Accept or 
Reject 

i. Run the Alternating Test(i) with input 

ii. Run the Witness Test(t) with input being the 
output state of the Alternating Test(t). 

iii. Output Accept iff both Tests output Accept. 

(b) If O outputs Accept then output Accept and halt. 

2. Output Reject. 



Running time: We have seen that the description of the circuit that performs the Alternating Test(t) 
can be generated in time polynomial \n.t-k which is polynomial in The description of the circuit 
that performs the Witness Test(t) can also be generated in polynomial-time, since the circuit family 
{Vx : X G {0,1}*} can be generated uniformly in polynomial-time. Hence the description of the 
circuit ^* can be generated in polynomial-time and the overall algorithm A runs in polynomial-time. 

Correctness in case x E Ly^s' Let us consider the oracle call with input A'^ where d is the 
dimension of Wx- We prove that G UQMA-CPPyes, hence the oracle O outputs Accept and 
therefore A outputs Accept as well. Our claim is immediate from the following lemma. 

Lemma 3 1. Pr[yl^ outputs Accept on \Waitl] > 2/3. 

2. Let 10) G n^'^ be orthogonal to \Wait)- Then Pr[A'^ outputs Accept on < 1/3. 

Proof Part (1): Since \Wait) € Alt^*'*, Lemma [U tells us that the Alternating Test(d) outputs the 
state and Accept with probability 1. Then, since for every i £ [d] the support of the reduced 

density matrix of |Wait) on register Tj is on Wx, Lemma [2] tells us that the Witness Test outputs 
Accept with probability at least 2/3. 

Part (2): By Claim |4] and the fact that the state {(p) is orthogonal to |VFa/i)i we can conclude that if 
the Alternating Test((i) outputs Accept then the output state is a pure state G {W^'^)-^. Now, by 
Lemma [21 the probability that the Witness Test(c?) outputs Accept on input is at most 1/3. □ 

Correctness in case x G Lno- By Lemma[2]it follows easily that for all t £ [q] : A\. £ UQMA-CPPno- 
In this case, O outputs Reject in every iteration, and hence A outputs Reject. 
This concludes the proof of Theorem [31 □ 
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A Yet another definition of FewQMA 

We have seen two possible definitions for the class FewQMA and have proven their equivalence. In 
high level, one says that in the yes instances there is a polynomial number of eigenvalues of the 
projection operator II^,. that are larger than 2/3, while no eigenvalue is in the interval (1/3, 2/3). The 
other definition says that in a yes instance there exists a subspace of polynomial dimension such that 
every state in the subspace is accepted with probability at least 2/3 and every state orthogonal to 
this subspace is accepted with probability at most 1/3. 
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A natural question is whether the use of a subspace is necessary in the second definition or we 
could have just talked about a set of orthonormal vectors of polynomial size, where each vector is 
accepted with probability 2/3 and every vector orthogonal to these ones is accepted with probability 
at most 1/3. While we are unable to show the equivalence of the complexity class defined this way 
and FewQMA, a weak equivalence can indeed be shown. For this we include the parameters of the 
verification procedure and the bound on the number of witnesses in the definition of the class, and 
we also require strong amplification. More precisely, consider the following definition. 

Definition 7 Let c,w,s : N [0, 1] be polynomial time computable functions such that c{n) > 
max{w{n), s{n)} for all n € N. Let q,k,m be polynomials such that q{n) < 2^("'' for all n G N. 
A promise problem L = (Lyes, Lno) is in the complexity class Vector Few Quantum Merlin- Arthur 
Vector- FewQM A (c, w, s, q, k, m) if there exists a verification procedure {Vx : x £ {0, 1}*} with k witness 
qubits and m ancilla qubits, such that 

1. for all X G Lyes there exists an orthonormal basis {j'i/'i), . . . , |'i/'2*)} witness space and 
d G such that 

(a) for all pure states IV^i) with i £ [d], HHaccVirdV'i) lO"*))!!^ > 

(b) for all pure states with d + 1 <i<2^, | in^cc^d^/'i) ® |0'"))|P < w{\x\), 

2. for all x E L„o and for all pure states G B'^^ , \\IiaccVx{\ip) ® |0'"))|p < s{\x\). 
Finally we define 

Vector-FewQMA = M Vector- FewQM A (1 - ^, ^r^, \,q,k,m) . 

oq o ' ^ o 

polynomials q,k,m: g<2'= 

We show Vector-FewQMA = FewQMA. For showing the equivalence we use Horn's Theorem that 
states that for a Hermitian matrix, the vector of the eigenvalues majorizes the diagonal. 

Theorem 4 [13j Let R be a natural number. Let A = {Ai > A2 > . . . > A/j|Aj G M} and A = {/zi > 
^ • • • ^ l^R\l^i G IR}- Then there exists an R x R Hermitian matrix with set of eigenvalues A and 
set of diagonal elements A if and only if ^ j^;^ (Aj — /^j) > for all t G [R] and with equality for t = R. 

Theorem 5 

FewQMA = Vector-FewQMA . 

Proof We first show FewQMA C Vector-FewQMA. Let L G FewQMA have a verification procedure 
{Vf. : X G {0,1}*} with polynomials k,m',q. Let r be a polynomial such that 2^^' < and 
2^^ < We know from Theorem [2] that L G FewQMA(l — 2"*", 2"'', 2~'^) with verification procedure 
{Vx : X G {0,1}*} and polynomials k,m,q, where m = poly{m' ,r). Then the eigenbasis of Hx 
satisfies the requirements of the definition of Vector- FewQM A(l — ^-^^r, |, q, k, m). This shows that 
L G Vector-FewQMA. 

We now show Vector-FewQMA C FewQMA. Let L G Vector- FewQM A(l - ^,\,q,k,m), for 
some polynomials q,k,m such that q < 2^. Let N = 2^ and 7i = B®^ . If x G Ly^s, then there exist 
an orthonormal basis {IV'i), • • • , I'^Tv)} for Ti and d G [g], such that for i G [d], > 1 — ^ and for 
d + l<i<N^^i<-^, where by definition 

^i^ = Wi^accVxm ® |o"^))||2 = (v^.i (o"^|n,|^,> ® lo'-) . 
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Consider now the Hermitian nicitrix ]\d that describes tlic projection operator Tlx 

in a basis that is 

an extension of {{ipi)'^ |0™), . . . , |Va^) "X" lO™")}. Note that & [N] are the first N diagonal elements 
of M. Observe that an eigenvector of Ila; with non-zero eigenvalue is also an eigenvector of H-init with 
non-zero eigenvalue. Since there are N non-zero eigenvalues of Hj^jj, there are at most N non-zero 
eigenvalues of Tlx- This also implies that = for < i < 2^^+"^. Let the first N eigenvalues of Hx 
in decreasing order be Ai,i G [A'']. Then, using Horn's theorem, 

d d ^ 

i=l i=l ^ 

which implies (since Aj < 1, for all i G [N\) that 



Also, we have that 



i=d+l i=d+l i=d+l 

If x G then by the soundness condition Ai < i. This shows that L G FewQMA. □ 
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